extra/runner/run: Pass extra command-line arguments to test script

Commit bf393c1d taught `stbt run` to pass extra command-line arguments
to the test script. This current commit does the same for
`extra/runner/run`, the script for running multiple test scripts in
bulk. This allows you to run the same test script with different
arguments when you need to run multiple permutations of a test case.

To use this, place "--" on the command line between test scripts to run:

    runner/run test1.py arg1 arg2 -- test2.py ...

Without the "--", each argument is treated as a separate test, the same
way it worked before this commit. This makes it convenient to use bash's
brace expansion when you don't need to pass arguments to any of the test
scripts:

    runner/run very/long/path/to/{test1.py,test2.py,test3.py}

If you want to pass arguments to a single test script, place a "--" at
the end:

    runner/run test.py arg1 arg2 --

IMPLEMENTATION NOTES
--------------------

The implementation tries hard to preserve whitespace in arguments:

`read -a test` reads from standard input into the array variable `test`.

`IFS=$'\t' read ...` makes `read` split elements on tabs, not on any
whitespace (`$'\t'` is a string containing a single tab character).
Unfortunately you can't use `IFS=$'\0'` (split on the null character)
because bash internally uses C-style null-terminated strings. Tab is
a character that hopefully won't appear in genuine user arguments.

`"${test[@]}"` (and `"$@"` for the parameters to a function)
individually quotes each element in the array.

See:

http://www.gnu.org/software/bash/manual/html_node/Arrays.html
http://www.gnu.org/software/bash/manual/html_node/Bash-Builtins.html#index-read
http://www.gnu.org/software/bash/manual/html_node/ANSI_002dC-Quoting.html
extra/runner/run: Fix infinite loop

The previous commit (233889de) ran the `while` loop from a sub-process,
because of the `parse_test_args | while` pipeline. Inside this
sub-process, any `break` statement couldn't affect the parent process,
so it couldn't break out of the outermost `while true` loop. Similarly,
any `exit` called from `run` would stop the current iteration, but it
wouldn't exit the parent process, so another iteration would run.

By moving the `parse_test_args` call outside of a pipeline, the `while
read ...` loop is run in the main process. `while` and `read` are both
bash builtins.
extra/runner/run: Cleanup: Rename variable from `_test` to `testpath`

For clarity. We already had `test` and `_test`.
extra/runner/report.py: HTML-escape user input

Escape input entered by the user via the web interface to avoid XSS
attacks in case the server is run on a public or untrusted network.

User-entered data is only stored in files with the ".manual" extension.
You can still have your `classify` script enter html links in
`failure-reason` etc; changing those scripts requires access to the
server anyway, so they are considered trusted.